What’s Vulnerable › Products

Simple Membership vulnerabilities

37 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 18 published in the last 12 months.

Check whether your Simple Membership version is affected

Latest Simple Membership vulnerabilities

• CVE-2026-88785 — Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String (CVSS 4.7)
• CVE-2026-103427 — Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field (CVSS 6.4)
• CVE-2026-97337 — Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints (CVSS 7.5)
• CVE-2026-74000 — WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-88764 — Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref (CVSS 5.4)
• CVE-2026-77194 — Simple Membership <= 4.8.1 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding (CVSS 5.3)
• CVE-2026-14936 — Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification (CVSS 5.3)
• CVE-2026-66712 — WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-15931 — Simple Membership < 4.7.8 - Unauthenticated Stored XSS via PayPal Subscription Subscriber Name (CVSS 6.1)
• CVE-2026-15930 — Simple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision (CVSS 9.4)
• CVE-2026-11855 — Simple Membership < 4.7.5 - Unauthenticated Stored XSS via Stripe Webhook API Version (CVSS 8.8)
• CVE-2026-12093 — Simple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook (CVSS 5.3)
• CVE-2026-42663 — WordPress Simple Membership plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
• CVE-2026-34886 — WordPress Simple Membership plugin <= 4.7.1 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-1461 — Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values (CVSS 6.5)
• CVE-2026-25308 — WordPress Simple Membership plugin <= 4.6.9 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2025-49333 — WordPress Simple Membership plugin <= 4.6.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
• CVE-2024-11088 — Simple Membership <= 4.5.5 - Exposure of Private Personal Information to an Unauthorized Actor (CVSS 7.5)
• CVE-2024-49682 — WordPress Simple Membership plugin <= 4.5.3 - Open Redirection vulnerability (CVSS 6.1)
• CVE-2023-41957 — WordPress Simple Membership plugin <= 4.3.4 - Unauthenticated Membership Role Privilege Escalation vulnerability (CVSS 9.8)
• CVE-2023-41956 — WordPress Simple Membership plugin <= 4.3.4 - Authenticated Account Takeover vulnerability (CVSS 8.8)
• CVE-2024-4383 — Simple Membership <= 4.4.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
• CVE-2024-3730 — Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
• CVE-2024-1985 — Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting (CVSS 6.1)
• CVE-2024-22308 — WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection (CVSS 6.1)